UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 11.8 Free with a free account
The Laws That Protect Your Personal Data and Control How Organizations Use It
Ethics in Technology · Chapter 11: Secure Tunnels, Digital Rights, and Intellectual Property in a Connected WorldSection 11.8 · lesson 65 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: How Police and Federal Agencies Investigate and Prosecute Crimes Committed Online →← Open Source and Software OwnershipNext lesson: How Police and Federal Agencies Investigate and Prosecute Crimes Committed Online →
In this lesson
Fair information practices, meaningful choices, and limits on organizational power.
- Trace the five 1973 principles into modern data protection rights.
- Explain the Privacy Act’s protections, scope, exceptions, and remedies.
- Compare GDPR lawful grounds with California and other state rights.
- Assess notice, consent, alternative protections, and who must act.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,648 words). Read along, or search it.
Chapter 11
Privacy Law and Personal Data Rights
Privacy law concerns how organizations collect, use, share, secure, and retain information about people. Many rules reflect longstanding principles, rather than entirely unrelated ideas. We will trace five principles from a nineteen seventy-three federal advisory report. The Privacy Act then put important protections into a defined federal records framework. Its scope leaves ordinary consumer business activity governed by other laws. Modern protections include access, correction, deletion, portability, defined opt-outs, and protection against prohibited retaliation. Those rights have different purposes, conditions, and exceptions. We will compare Europe’s lawful-basis framework with California and other state approaches. Consent is only one legal ground, and a recorded click does not establish every requirement. Finally, we will assess notice, practical choice, baseline protections, loyalty, and recognized privacy signals. The central question is whether people gain meaningful control, alongside enforceable organizational responsibility.
Foundational Principles
Five Ideas From 1973 Still Explain Much of Privacy Law
In nineteen seventy-three, a federal advisory committee examined computerized personal record keeping. Its first principle opposed systems whose very existence was secret. That idea supports modern notice, transparency, and openness. Second, people should be able to discover what is recorded and how it is used. That principle supports access and information about processing. Third, people should be able to prevent reuse for another purpose without their consent. Fourth, they should be able to correct or amend identifiable records. Fifth, organizations should ensure reliable data and take reasonable precautions against misuse. Later international lists elaborate collection limits, specified purposes, data quality, security, participation, and accountability. These ideas influenced modern laws, but each jurisdiction has its own grounds and exceptions. Secondary uses create continuing tension, because their value can depend on combinations nobody anticipated at collection.
Federal Records
The Privacy Act of 1974 Governs Defined Federal Systems of Records
The Privacy Act was enacted in nineteen seventy-four, amid concern about government files. It governs defined federal agencies, rather than every organization possessing personal information. A system of records involves agency-controlled information retrieved by a name or another personal identifier. The Act generally defines covered individuals as American citizens or lawful permanent residents. Specific additional protections and exemptions require separate attention. Agencies publish system notices describing categories, purposes, and relevant routine uses. Covered individuals can obtain records and request appropriate amendment. Agencies must account for specified disclosures, while some disclosure categories are excluded. Disclosure generally requires written consent unless a statutory exception applies. The Act also provides defined judicial remedies for noncompliance. Those remedies have different requirements, so a request for records differs from a damages lawsuit.
Scope and Enforcement
Four Limits Matter, but “Every Private Company Is Exempt” Goes Too Far
Four limits explain why the Privacy Act is not a general consumer privacy law. Ordinary state, local, and private-sector activity generally falls outside its federal-agency scope. However, covered contractor-operated federal systems can carry the Act’s requirements. The system-of-records definition also depends on retrieval by a specified personal identifier. Information being identifiable is not, by itself, the entire test. A published routine use must be compatible with the original collection purpose. Publishing a broad description does not authorize any imaginable reuse, and other statutory exceptions also exist. Relevant damages claims require proof of the violation, causation, adverse effect, and intentional or willful conduct. The Supreme Court’s twenty twelve Cooper decision requires proven economic harm for that monetary remedy. Access and amendment claims can seek court orders without that same economic-loss requirement. A February twenty twenty-six GAO report describes separate sector-specific and state protections, without a comprehensive federal private-sector counterpart.
Knowing and Repairing
Access, Correction, and Deletion Solve Different Problems
Access lets someone obtain covered personal data and information about uses and recipients. It is foundational, because correcting or challenging hidden information first requires knowing what exists. Under GDPR, access can extend to inferred personal data, subject to applicable limits. Correction addresses inaccurate facts and relevant incomplete records. Correcting a mistaken birth date differs from disputing an evaluative opinion or inference. Deletion requires erasure when the applicable law’s defined grounds are satisfied. It is not an unconditional instruction to erase every record or end every service relationship. Under GDPR, legal retention, expression, public interests, and legal claims can justify specified exceptions. Necessary records can remain while other processing ends. Mentioning a contract is not a blanket exception from the GDPR erasure rules. Assess the actual processing, lawful necessity, applicable ground, and specific right being exercised.
Leaving and Objecting
Portability, Defined Opt-Outs, and Protection Against Retaliation
Portability provides qualifying data in a structured, commonly used, machine-readable form. Where technically feasible, it can also support direct transfer to another provider. Under GDPR, it concerns automated processing based on consent or contract. Provided data can include observed activity, while inferred analysis generally falls outside that portability scope. The purpose includes competition, because reusable information reduces service lock-in. A file becomes useful only if the receiving service can actually interpret it. Opt-outs stop specified practices, such as covered sales, targeted advertising, or consequential profiling. California sharing refers to cross-context behavioral advertising, rather than every ordinary data transfer. GDPR’s direct-marketing objection differs from general objection, where qualifying compelling grounds may matter. Nondiscrimination rules prevent prohibited punishment for exercising protected rights. Allowed incentives, lawful price differences, and genuinely unavailable functions require their own conditions and assessment.
Comparing Legal Models
GDPR Requires a Lawful Basis; U.S. State Rules Combine Duties and Defined Choices
GDPR requires an applicable lawful basis before personal data processing begins. Consent is one of six grounds, rather than the only permitted approach. The others concern contract, legal obligation, vital interests, public tasks, and legitimate interests. Each has conditions, while principles and individual rights continue to apply. California’s CCPA, amended by the CPRA, combines organizational duties with defined consumer choices. These include access, correction, deletion, copies, sale or sharing opt-outs, sensitive-use limits, and nondiscrimination. The law applies to covered businesses and includes defined scope and exceptions. Other comprehensive state laws share many rights, but thresholds, exemptions, enforcement, and sensitive-data rules vary. Not every state requires the same sensitive-data opt-in approach. GAO’s February twenty twenty-six report counted nineteen enacted state laws using a November twenty twenty-five snapshot. That count included later effective dates, so it must not be presented as today’s exact in-force total.
Notice and Consent
The Model Assumes an Informed Reader With a Real Alternative
Notice and consent promises a person meaningful control over an organization’s practices. First, the organization explains what data it processes, for which purposes, and with which recipients. Second, the individual considers the information and decides whether to accept. Third, when consent is the legal basis, agreement must meet the applicable validity conditions. Finally, the organization must follow the lawful scope, while rights and accountability continue. The model is attractive because it promises autonomy and can operate at large scale. It need not require a regulator to approve every individual decision. However, privacy rights also operate through requests, mandatory duties, and enforcement. They are not all delivered through consent. A logged click can document an answer without proving meaningful understanding or freedom. Assess what the interface and actual circumstances allow the person to do.
Five Failure Modes
Reading Burdens, Weak Choices, and Unknown Futures Undermine the Promise
Five recurring problems undermine the notice-and-consent model’s assumptions. First, reading many lengthy policies creates a heavy burden. McDonald and Cranor’s two thousand eight study estimated several working weeks of annual reading. That historical estimate illustrates scale, rather than measuring every person’s current behavior. Second, vague or legalistic categories can conceal practices even from an attentive reader. Third, refusing a needed service may be unrealistic, especially without a meaningful competing option. Fourth, interfaces can make acceptance easy and refusal difficult, or preselect an answer. Such manipulation can undermine legal consent validity as well as ethical choice. Fifth, future combinations, analytical methods, purposes, and ownership changes may be difficult to foresee. An unlimited vague notice cannot simply authorize everything that might later happen. Ask who benefits from documented agreement, and whether the person’s formal choice provides real understanding and control.
Stronger Baselines
Three Alternatives Judge the Practice, Rather Than Only the Agreement
Several approaches place stronger limits on practices beyond asking whether someone agreed. Data minimization restricts collection to what is genuinely necessary for a justified purpose. Its difficult question is who defines necessity and evaluates potential future benefits. Purpose limitation requires appropriate justification for reuse, rather than relying on a broadly worded notice. That can constrain profitable or useful secondary activities, making workable compatibility rules important. Substantive prohibitions ban specified harmful practices even when an individual would accept them. They require collective judgments about unacceptable activity and can narrow individual choices. These ideas are not absent from current law. GDPR already includes minimization and purpose limitation, while other laws prohibit specified conduct. Reform can strengthen, extend, or enforce those existing baselines. The focus shifts toward acceptable practices, rather than treating agreement as a complete ethical justification.
Loyalty and Practical Control
Stronger Duties and Recognized Signals Address Different Parts of the Problem
A duty of loyalty asks data holders to consider the person’s interests. It goes beyond simply announcing practices that benefit the organization. Such a duty can conflict with advertising or monetization models, so scope and enforcement matter. Recognized universal opt-out signals address a different problem: repeated company-by-company refusals. A browser or device setting can communicate a legally recognized preference to covered services. Honoring depends on the jurisdiction, business coverage, and applicable signal requirements. It does not control every organization worldwide or erase every record automatically. Signals improve practical exercise of choices, but do not settle which underlying practices are acceptable. Minimization, purpose limits, prohibitions, and loyalty shift more responsibility toward organizations and public institutions. The debate balances autonomy, baseline protection, regulatory judgment, and useful innovation. Stronger protection can also make meaningful autonomy possible, rather than always opposing individual choice.
Review and Application
Five Questions Connect the Legal Rules With Their Ethical Purpose
For review, first explain why the Privacy Act is limited for ordinary consumer business data. Identify federal-agency scope, qualified contractor coverage, identifier retrieval, disclosure exceptions, and remedy-specific barriers. Second, distinguish access from portability by both purpose and scope. Access reveals information and processing, while portability provides qualifying reusable data that helps someone leave. Third, compare a lawful-basis framework with defined opt-out mechanisms. Defaults and duties determine who must act, and recognized signals can reduce repeated individual effort. Fourth, explain why notice and consent can fail. Use reading burdens, vague explanations, dependence, manipulative interfaces, and uncertain future uses as distinct examples. Fifth, explain what stronger baseline proposals share and why their authority is contested. They evaluate acceptable practices beyond agreement, raising questions about necessity, loyalty, autonomy, regulation, and innovation. Always connect the applicable legal right with its conditions, enforcement, and the person’s actual understanding and control.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About The Laws That Protect Your Personal Data and Control How Organizations Use It
What are the Fair Information Practice Principles?
Does the Privacy Act of 1974 apply to private companies?
What is the difference between the right of access and the right to data portability?
Why is notice and consent considered a weak privacy protection?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →